Upload-labs文件上传漏洞（.htaccess文件）——Pass04

野性酷女 2023-03-01 14:59 13阅读 0赞

0×00 题目描述

![20200727154752878.png][]

我看你是在为难我胖虎

![20200727154827910.jpg][]

经过pass03知道了看源代码的作用。来分析一下源码

0×02 源代码分析

$is_upload = false;
    $msg = null;
    if (isset($_POST['submit'])) {
        if (file_exists(UPLOAD_PATH)) {
            $deny_ext = array(".php",".php5",".php4",".php3",".php2","php1",".html",".htm",".phtml",".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2","pHp1",".Html",".Htm",".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",".swf");
            $file_name = trim($_FILES['upload_file']['name']);
            $file_name = deldot($file_name);//删除文件名末尾的点
            $file_ext = strrchr($file_name, '.');
            $file_ext = strtolower($file_ext); //转换为小写
            $file_ext = str_ireplace('::$DATA', '', $file_ext);//去除字符串::$DATA
            $file_ext = trim($file_ext); //收尾去空
    
            if (!in_array($file_ext, $deny_ext)) {
                $temp_file = $_FILES['upload_file']['tmp_name'];
                $img_path = UPLOAD_PATH.'/'.date("YmdHis").rand(1000,9999).$file_ext;
                if (move_uploaded_file($temp_file, $img_path)) {
                    $is_upload = true;
                } else {
                    $msg = '上传出错！';
                }
            } else {
                $msg = '此文件不允许上传!';
            }
        } else {
            $msg = UPLOAD_PATH . '文件夹不存在,请手工创建！';
        }
    }

还是存在着黑名单过滤，所以需要找到黑名单之外的一个文件后缀

找到的就是.htaccess文件，可以重写规则

htaccess文件：是[Apache][]服务器中的一个配置文件，它负责相关目录下的网页配置。通过htaccess文件，可以帮我们实现：网页[301重定向][301]、自定义404错误页面、改变文件扩展名、允许/阻止特定的用户或者目录的访问、禁止目录列表、配置默认文档等功能。

原理：他没有过滤 .htaccess后缀，我们可以构建一个htaccess配置文件，让所有格式文件都解析为php，然后再上传图片马（只要后缀是允许的，随便都可以）就会被解析了。

文件内容如下

SetHandler application/x-httpd-php

这行代码的意思是代码的意思是通过一个.htaccess 文件调用 php 的解析器去解析任意文件，即所有文件都会被解析为php

上传该文件可以直接成功

![20200727161614933.png][]

![20200727161714887.png][] 这样一来我们就可以上传文件名后缀为jpg/png/gif其实内容为php的文件了

如图被成功解析

[20200727154752878.png]: /images/20230208/ac645bcb4e19435a9bbc91b60987ed59.png
[20200727154827910.jpg]: https://img-blog.csdnimg.cn/20200727154827910.jpg
[Apache]: https://baike.baidu.com/item/Apache
[301]: https://baike.baidu.com/item/301%E9%87%8D%E5%AE%9A%E5%90%91
[20200727161614933.png]: https://img-blog.csdnimg.cn/20200727161614933.png
[20200727161714887.png]: https://img-blog.csdnimg.cn/20200727161714887.png